topic Re: Checkpoint blocked its own updater UID612340.pyc as Trojan in Endpoint

Checkpoint blocked its own updater UID612340.pyc as Trojan

64Bit — Mon, 05 Jul 2021 09:43:14 GMT

Our users are getting a notification that the Ant-Malware blade has blocked a Python script.

On investigation we found its actually Checkpoints own updater.

C:\ProgramData\CheckPoint\Endpoint Security\TPCommon\Updater\ATPS\Working\652743B2ED95EABB5DE5D88CDC51BF9E396216CD\cuckoo\protections\general\UID612340.pyc

Is there an actual issue with this script or should we add a manual exclusion for this ?

Re: Checkpoint blocked its own updater UID612340.pyc as Trojan

BrockCap — Mon, 05 Jul 2021 09:46:19 GMT

Hi there 64Bit,

Our users also started getting this alert at just after 4pm today, Perth, Western Australia time. I have a case logged with CP support so I'd be happy to let you know the outcome of that if you like? We've never experienced this issue before so safe to say you shouldn't have to add an exclusion but will confirm.

I was glad to see your post because I wanted confirmation it wasn't just us.

Thanks

Re: Checkpoint blocked its own updater UID612340.pyc as Trojan

_Val_ — Mon, 05 Jul 2021 09:48:06 GMT

Please open a TAC case for this

Re: Checkpoint blocked its own updater UID612340.pyc as Trojan

afoggia — Mon, 05 Jul 2021 11:12:28 GMT

Hi , same issue, in my organization , all in quarantine

thanks

Antonio Foggia

Re: Checkpoint blocked its own updater UID612340.pyc as Trojan

PhoneBoy — Mon, 05 Jul 2021 14:54:40 GMT

Looks like a false positive in the Anti-Malware signatures.
New signatures should be available in the next few hours that address this.

Re: Checkpoint blocked its own updater UID612340.pyc as Trojan

Joe_Matthews — Thu, 08 Jul 2021 13:51:02 GMT

Does anyone know if this file (UID612340.pyc) gets recreated or recompiled after the endpoint updates or if this file is even need for proper function of the endpoint? Since the file was deleted there is no way to restore it but if it is not needed do we even concern ourselves with it?